Bug 8559

Summary: Signing to sstate archives and signature verification should allow to use a custom GPG keys directory
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Daniel Istrate <daniel.alexandrux.istrate>
Component: coreAssignee: Ross Burton <ross.burton>
Status: RESOLVED FIXED QA Contact: Daniel Istrate <daniel.alexandrux.istrate>
Severity: enhancement    
Priority: Medium CC: meta.mr.watcher, meta.watcher
Version: 1.9   
Target Milestone: 2.1   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Yes (doc changes required)

Description Daniel Istrate 2015-10-22 15:09:08 UTC 
When signing sstate you should be able to specify where the gpg keys are located.
Similar implementation for rpm signing http://lists.openembedded.org/pipermail/openembedded-core/2015-October/111550.html

if GPG_PATH is specified use that instead of ~/.gnugpg/ .

Steps to validate:
gpg --gen-key <and provide all the details required> --> this will create the gpg keys in ~/.gnugpg

gpg --homedir /home/daniel/poky/meta-selftest/files/signing/ --gen-key <and provide all the details required> --> this will create the gpg keys in your specified directory

To list the keys use:
gpg --list-key
gpg --homedir /home/daniel/poky/meta-selftest/files/signing/ --list-key

1. Add to conf/local.conf (Please update the values accordingly)

SSTATE_SIG_KEY ?= "61EEFB30" <-- the pub key from custom dir (eg. pub   2048R/61EEFB30 2015-10-21)
SSTATE_SIG_PASSPHRASE ?= "test123"
SSTATE_VERIFY_SIG ?= "1"
SSTATE_DIR ?= '/media/ssd/poky-build/daniel-sstate'
GPG_PATH = /home/daniel/poky/meta-selftest/files/signing/

2. bitbake -c cleansstate ed
3. bitbake -c clean ed
4. bitbake ed  <-- should succeed and use the key from GPG_PATH

5. To validate even further:
[daniel@fedora-ws poky-build]$ gpg --verify daniel-sstate/ed/sstate:ed:i586-poky-linux:1.9:r0:i586:3:ed923fc0a937005a38e87d24bc219ec1_populate_sysroot.tgz.sig daniel-sstate/ed/sstate:ed:i586-poky-linux:1.9:r0:i586:3:ed923fc0a937005a38e87d24bc219ec1_populate_sysroot.tgz
gpg: Signature made Thu 22 Oct 2015 01:45:09 PM EEST using RSA key ID 61EEFB30
gpg: Good signature from "testuser (nocomment) <testuser@email.com>"


Also there is an oe-selftest waiting for this feature that also validates #8182
https://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/commit/?h=distrate/bug_8182&id=664fad667aa4102b5ab8ffa3447bfcaa0851c482
Comment 1 Ross Burton 2015-10-24 00:13:29 UTC 
Patch 'sstate: respect GPG_BIN and GPG_HOME' sent to the list.
Comment 2 Ross Burton 2016-01-26 14:23:46 UTC 
Merged in oe-core 6daf138822bbbc46960121d3b76b42eaf19e7c0e.